Skip to main content

Изменение конфигурации настройки по умолчанию

Вы можете изменить существующую конфигурацию настройки по умолчанию для code scanning для лучшего соответствия требованиям безопасности кода.

Кто может использовать эту функцию?

Code scanning доступен для репозиториев, принадлежащих организации, в GitHub Enterprise Server. Для этой функции требуется лицензия на GitHub Advanced Security. Дополнительные сведения см. в разделе Сведения о GitHub Advanced Security.

About editing your configuration of default setup

After running an initial analysis of your code with default setup, you may need to make changes to your configuration to better meet your code security needs. For existing configurations of default setup, you can edit:

  • Which languages default setup will analyze.
  • The query suite run during analysis. For more information on the available query suites, see "CodeQL query suites."

If your codebase depends on a library or framework that is not recognized by the standard libraries included with CodeQL, you can also extend the CodeQL coverage in default setup using CodeQL model packs. For more information, see "Extending CodeQL coverage with CodeQL model packs in default setup."

If you need to change any other aspects of your code scanning configuration, consider configuring advanced setup. For more information, see "Configuring advanced setup for code scanning."

Customizing your existing configuration of default setup

  1. On your GitHub Enterprise Server instance, navigate to the main page of the repository.

  2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of a repository header showing the tabs. The "Settings" tab is highlighted by a dark orange outline.

  3. In the "Security" section of the sidebar, click Code security and analysis.

  4. In the "CodeQL analysis" row of the "Code scanning" section, select , then click View CodeQL configuration.

  5. In the "CodeQL default configuration" window, click Edit.

  6. Optionally, in the "Languages" section, select or deselect languages for analysis.

  7. Optionally, in the "Query suite" row of the "Scan settings" section, select a different query suite to run against your code.

  8. To update your configuration, as well as run an initial analysis of your code with the new configuration, click Save changes. All future analyses will use your new configuration.

Defining the alert severities that cause a check failure for a pull request

When you enable code scanning on pull requests, the check fails only if one or more alerts of severity error, or security severity critical or high are detected. The check will succeed if alerts with lower severities or security severities are detected. For important codebases, you may want the code scanning check to fail if any alerts are detected, so that the alert must be fixed or dismissed before the code change is merged. For more information about severity levels, see "About alert severity and security severity levels."

  1. On your GitHub Enterprise Server instance, navigate to the main page of the repository.

  2. Under your repository name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of a repository header showing the tabs. The "Settings" tab is highlighted by a dark orange outline.

  3. In the "Security" section of the sidebar, click Code security and analysis.

  4. Under "Code scanning", to the right of "Check Failure", use the drop-down menu to select the level of severity you would like to cause a pull request check failure.

Extending CodeQL coverage with CodeQL model packs in default setup

Note: CodeQL model packs and the CodeQL model editor are currently in beta and subject to change. During the beta, model packs are supported only by Java/Kotlin analysis.

If you use frameworks and libraries that are not recognized by the standard libraries included with CodeQL, you can model your dependencies and extend code scanning analysis. For more information, see Supported languages and frameworks in the documentation for CodeQL.

For default setup, you need to define the models of your additional dependencies in CodeQL model packs. You can extend coverage in default setup with CodeQL model packs for individual repositories, or at scale for all repositories in an organization.

For more information about CodeQL model packs and writing your own, see "Using the CodeQL model editor."

Extending coverage for a repository

  1. In the .github/codeql/extensions directory of the repository, copy the model pack directory which should include a codeql-pack.yml file and any .yml files containing additional models for the libraries or frameworks you wish to include in your analysis.
  2. The model packs will be automatically detected and used in your code scanning analysis.
  3. If you later change your configuration to use advanced setup, any model packs in the .github/codeql/extensions directory will still be recognized and used.

Extending coverage for all repositories in an organization

Note: If you extend coverage with CodeQL model packs for all repositories in an organization, the model packs that you specify must be published to the GitHub Container registry and be accessible to the repositories that run code scanning. For more information, see "Configuring a package's access control and visibility."

  1. In the upper-right corner of GitHub, select your profile photo, then click Your organizations.

  2. Under your organization name, click Settings. If you cannot see the "Settings" tab, select the dropdown menu, then click Settings.

    Screenshot of the tabs in an organization's profile. The "Settings" tab is outlined in dark orange.

  3. Click Code security and analysis.

  4. Find the "Code scanning" section.

  5. Next to "Expand CodeQL analysis", click Configure.

  6. Enter references to the published model packs you want to use, one per line, then click Save.

    Screenshot of the "Expand CodeQL analysis" view" in the settings for an organization.

  7. The model packs will be automatically detected and used when code scanning runs on any repository in the organization with default setup enabled.